Where the data comes from, and why you can check it.
Five steps, from a public document to an answer your team can act on. The rule underneath all of them: a fact either points at a document and quotes the words that support it, or it is flagged as inferred and ranked below everything that does. Nothing is stored because a model said so.
1 · Acquire, under each jurisdiction's rules
GB and US begin with customer-ingestible authoritative project registers. Brazil's ANEEL adapter remains outside customer storage until its ODbL product boundary is approved. India's CEA PDF adapter is also implemented, but requires the authority's prior reproduction permission and durable identity across quarterly rows before customer ingestion. Procurement, additional countries and news overlays activate only after their legal, mapping, canary and evaluation gates pass. Each geography has its own policy pack: what may be fetched, at what rate, what counts as personal data there and what may never leave the region. A source that is legal to crawl in one country and not in another is not a code path — it is a pack entry.
2 · Extract, with the quote or not at all
Deterministic rules first, then models where prose demands it. Every extraction is checked before it is stored: the quote must appear verbatim in the document at the offsets given, the predicate must exist in the versioned vocabulary, the value must coerce to that field's type, and the entity must actually be named in the quote.
An extraction failing any check is discarded rather than downgraded. A model that attributes a contract to the wrong company produces a claim that looks perfectly well-formed, and only checking the entity against the quote catches it.
3 · Append, never overwrite
A new value supersedes the old one; it does not replace it. Both remain, each with its own evidence and dates — when the world was that way, and when we recorded it. That is what makes “what did you believe in March?” answerable, and it is why we can measure a developer's said-versus-did as well as our own accuracy.
Ten syndicated copies of one press release count as one source, not ten. Independence is established by comparing the text itself, because agreement between copies of the same words is not corroboration.
4 · Resolve identity by authority where one exists
Two records naming the same company are merged when a registrar says so — a company registry identifier settles it without a person or a model being asked. Where no authority can, the pair goes to review rather than being guessed. Every merge is reversible and the reversal is itself recorded.
5 · Answer, and say how the answer was bounded
Every response carries what it cost, whether it is complete, what scope it was narrowed to, and what was left out. A truncated result says it was truncated. A shard whose index is behind says so. A source that did not answer is named.
Incomplete answers announce themselves, because a quietly short answer is indistinguishable from a confidently complete one — and only one of them is safe to act on.
Agents propose. They do not write.
Language models do a lot of the extraction here, and none of them can write to the record. An agent's output is a proposal that names the exact session that produced it — the prompt, the model, the tool calls — and waits for something accountable to accept it. Without a quote it is refused outright.
Customers correcting us go through the same queue, under the same requirement: name the document, quote the words. A paying customer's assertion is still an assertion, and not storing assertions is exactly what the evidence in every other answer is worth.
Models are measured, not trusted
Every model tier is benchmarked against the same adjudicated corpora the product is scored on, so migrating from one model to another is justified by a measured delta rather than a hunch. When a model cannot answer within budget, the answer says so instead of guessing.
Sector is a filter, never a product boundary
An AI data-centre campus is at once a construction project, a grid interconnection, a power-demand signal and a water abstraction question. Vendors that sell you one facet cannot join them, because their products are the boundary. Ours is one graph, and the moment we ship “the power module” we have rebuilt their weakness.